Annotation of src/usr.bin/ssh/auth-passwd.c, Revision 1.5
1.1 deraadt 1: /*
2:
3: auth-passwd.c
4:
5: Author: Tatu Ylonen <ylo@cs.hut.fi>
6:
7: Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
8: All rights reserved
9:
10: Created: Sat Mar 18 05:11:38 1995 ylo
11:
12: Password authentication. This file contains the functions to check whether
13: the password is valid for the user.
14:
15: */
16:
17: #include "includes.h"
1.5 ! deraadt 18: RCSID("$Id: auth-passwd.c,v 1.4 1999/09/29 22:22:16 dugsong Exp $");
1.1 deraadt 19:
20: #include "packet.h"
21: #include "ssh.h"
22: #include "servconf.h"
23: #include "xmalloc.h"
24:
25: #ifdef KRB4
26: extern char *ticket;
27: #endif /* KRB4 */
28:
29: /* Tries to authenticate the user using password. Returns true if
30: authentication succeeds. */
31:
32: int auth_password(const char *server_user, const char *password)
33: {
34: extern ServerOptions options;
35: extern char *crypt(const char *key, const char *salt);
36: struct passwd *pw;
37: char *encrypted_password;
38: char correct_passwd[200];
1.4 dugsong 39: char *saved_pw_name, *saved_pw_passwd;
1.1 deraadt 40:
41: if (*password == '\0' && options.permit_empty_passwd == 0)
42: {
43: packet_send_debug("Server does not permit empty password login.");
44: return 0;
45: }
46:
47: /* Get the encrypted password for the user. */
48: pw = getpwnam(server_user);
49: if (!pw)
50: return 0;
51:
1.4 dugsong 52: saved_pw_name = xstrdup(pw->pw_name);
53: saved_pw_passwd = xstrdup(pw->pw_passwd);
54:
1.2 dugsong 55: #if defined(KRB4)
56: /* Support for Kerberos v4 authentication - Dug Song <dugsong@UMICH.EDU> */
57: if (options.kerberos_authentication)
58: {
59: AUTH_DAT adata;
60: KTEXT_ST tkt;
61: struct hostent *hp;
62: unsigned long faddr;
63: char localhost[MAXHOSTNAMELEN]; /* local host name */
64: char phost[INST_SZ]; /* host instance */
65: char realm[REALM_SZ]; /* local Kerberos realm */
66: int r;
67:
68: /* Try Kerberos password authentication only for non-root
69: users and only if Kerberos is installed. */
70: if (pw->pw_uid != 0 && krb_get_lrealm(realm, 1) == KSUCCESS) {
71:
72: /* Set up our ticket file. */
73: if (!ssh_tf_init(pw->pw_uid)) {
74: log("Couldn't initialize Kerberos ticket file for %s!",
75: server_user);
76: goto kerberos_auth_failure;
77: }
78: /* Try to get TGT using our password. */
79: r = krb_get_pw_in_tkt((char *)server_user, "", realm, "krbtgt", realm,
80: DEFAULT_TKT_LIFE, (char *)password);
81: if (r != INTK_OK) {
82: packet_send_debug("Kerberos V4 password authentication for %s "
83: "failed: %s", server_user, krb_err_txt[r]);
84: goto kerberos_auth_failure;
85: }
86: /* Successful authentication. */
87: chown(ticket, pw->pw_uid, pw->pw_gid);
88:
89: (void) gethostname(localhost, sizeof(localhost));
1.3 deraadt 90: (void) strlcpy(phost, (char *)krb_get_phost(localhost), INST_SZ);
1.2 dugsong 91:
92: /* Now that we have a TGT, try to get a local "rcmd" ticket to
93: ensure that we are not talking to a bogus Kerberos server. */
94: r = krb_mk_req(&tkt, KRB4_SERVICE_NAME, phost, realm, 33);
95:
96: if (r == KSUCCESS) {
97: if (!(hp = gethostbyname(localhost))) {
98: log("Couldn't get local host address!");
99: goto kerberos_auth_failure;
100: }
101: memmove((void *)&faddr, (void *)hp->h_addr, sizeof(faddr));
102:
103: /* Verify our "rcmd" ticket. */
104: r = krb_rd_req(&tkt, KRB4_SERVICE_NAME, phost, faddr, &adata, "");
105: if (r == RD_AP_UNDEC) {
106: /* Probably didn't have a srvtab on localhost. Allow login. */
107: log("Kerberos V4 TGT for %s unverifiable, no srvtab installed? "
108: "krb_rd_req: %s", server_user, krb_err_txt[r]);
109: }
110: else if (r != KSUCCESS) {
111: log("Kerberos V4 %s ticket unverifiable: %s",
112: KRB4_SERVICE_NAME, krb_err_txt[r]);
113: goto kerberos_auth_failure;
114: }
115: }
116: else if (r == KDC_PR_UNKNOWN) {
117: /* Allow login if no rcmd service exists, but log the error. */
118: log("Kerberos V4 TGT for %s unverifiable: %s; %s.%s "
119: "not registered, or srvtab is wrong?", server_user,
120: krb_err_txt[r], KRB4_SERVICE_NAME, phost);
121: }
122: else {
123: /* TGT is bad, forget it. Possibly spoofed! */
124: packet_send_debug("WARNING: Kerberos V4 TGT possibly spoofed for"
125: "%s: %s", server_user, krb_err_txt[r]);
126: goto kerberos_auth_failure;
127: }
128:
129: /* Authentication succeeded. */
130: return 1;
131:
132: kerberos_auth_failure:
133: (void) dest_tkt();
134: xfree(ticket);
135: ticket = NULL;
136: if (!options.kerberos_or_local_passwd ) return 0;
137: }
138: else {
139: /* Logging in as root or no local Kerberos realm. */
140: packet_send_debug("Unable to authenticate to Kerberos.");
141: }
142: /* Fall back to ordinary passwd authentication. */
143: }
144: #endif /* KRB4 */
145:
1.1 deraadt 146: /* Save the encrypted password. */
1.4 dugsong 147: strlcpy(correct_passwd, saved_pw_passwd, sizeof(correct_passwd));
1.1 deraadt 148:
149: /* Check for users with no password. */
150: if (strcmp(password, "") == 0 && strcmp(correct_passwd, "") == 0)
151: {
152: packet_send_debug("Login permitted without a password because the account has no password.");
153: return 1; /* The user has no password and an empty password was tried. */
154: }
155:
1.4 dugsong 156: xfree(saved_pw_name);
157: xfree(saved_pw_passwd);
158:
1.1 deraadt 159: /* Encrypt the candidate password using the proper salt. */
160: encrypted_password = crypt(password,
161: (correct_passwd[0] && correct_passwd[1]) ?
162: correct_passwd : "xx");
163:
164: /* Authentication is accepted if the encrypted passwords are identical. */
1.2 dugsong 165: return (strcmp(encrypted_password, correct_passwd) == 0);
1.1 deraadt 166: }
![[BACK]](/icons/back.gif){kind=icon}
Return to auth-passwd.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh